ISO 27001 Risk Assessment: Methodology, Template and Examples

Common Method Choices

• Asset-threat-vulnerability: inventory information assets, map threats and vulnerabilities, score likelihood × impact.
• Scenario / event-based: describe realistic incident scenarios tied to business processes and rate consequences.
• Hybrid: asset register for coverage, scenarios for high-impact services (payments, identity, OT, AI pipelines).

Sample Risk Register Columns

Example Rows (Illustrative)

• Cloud admin compromise → MFA + privileged access review + logging (A.8 theme controls).
• Supplier outage exposing customer data → contractual security + supplier review (A.5 supplier controls).
• Lost laptop with local cache → disk encryption + remote wipe + clear desk/screen practices.

Frequently Asked Questions

Does ISO 27001 prescribe one risk method?

No. Clause 6.1.2 requires a defined process with criteria for accepting risks and identifying acceptable risk levels. Asset-based, scenario-based, or hybrid methods are all used in practice.

How often must risk assessment run?

At planned intervals and when significant changes are proposed or occur (Clause 8.2), using the criteria established in 6.1.2.

Is the Statement of Applicability part of risk treatment?

Yes. Producing the SoA is part of Clause 6.1.3 risk treatment.

Related ISO 27001 Resources

SoA guide · Gap analysis · Mandatory documents · ISO 27001 hub